Use WIF for OneLocBuild feed access

[missymessa]

Description of Change

Replace MAUI's long-lived dn-bot-ceapex-package-r dependency with a short-lived Entra token for OneLocBuild package restores.

• Acquire the Azure DevOps token through the existing DevDiv dnceng-onelocbuild-ceapex workload-identity service connection.
• Reuse Arcade's shared get-federated-access-token.yml helper.
• Pass the resulting secret CeapexEntraToken to OneLocBuild for the ceapex LCL/LocTools feeds.
• Keep the existing GitHub PR authentication unchanged.

The DevDiv service connection is configured for workload identity federation and MAUI pipeline 13330 is authorized to use it.

Validation

• Parsed the updated pipeline as YAML.
• Verified the shared federated-token helper exists on this branch.
• Verified the legacy ceapex PAT is no longer referenced by MAUI's repo-owned localization pipeline.

Issues Fixed

Tracks dnceng work item 10151.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 37607

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 37607"

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Hey there @@missymessa! Thank you so much for your PR! Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[dotnet-policy-service]

Hey there @missymessa! Thank you so much for your PR! Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[Copilot]

Pull request overview

This PR updates MAUI’s DevDiv localization pipeline to stop using a long-lived ceapex PAT for package restores and instead acquire a short-lived Azure DevOps access token via workload identity federation (WIF), then pass that token into OneLocBuild for feed authentication.

Changes:

• Replace the CeapexPat parameter with a CeapexServiceConnection parameter and acquire a federated access token via Arcade’s get-federated-access-token.yml.
• Pass the resulting secret variable (CeapexEntraToken) to OneLocBuild@2 through patVariable, while keeping the GitHub PR auth path unchanged.
• Minor documentation/comment adjustment opportunity: the OneLocBuildVariables comment is now more specific than related templates and can become misleading over time.

PR metadata alignment (pr-finalize check): the title and description appear consistent with the actual YAML changes. The PR description may still need the repo-required NOTE block at the top (per .github/PULL_REQUEST_TEMPLATE.md) if it isn’t already present in the actual PR body.